Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

International journal of network security

Towards Modelling Perfect Forward Secrecy for One-round Group Key Exchange.

Zheng Yang, Daigu Zhang

Published Mar 1, 2016• 8 citations
Publisher

Abstract

We propose two security models for one-round group key exchange (ORGKE), which are called as g-eCKw and g-eCK-PFS. The g-eCK-PFS is a stronger variant of g- eCKw, which particularly formulates perfect forward se- crecy for ORGKE. A new tripartite ORGKE is proposed to provide g-eCKw security without random oracles under standard assumptions, that is also more e_cient than its predecessor by Li and Yang on CANS'13. We also show how to transform (compile) a g-eCKw secure protocol to achieve g-eCK-PFS security. In particular, our result enables us to prove the security of the first ORGKE protocol that achieves perfect forward secrecy without random oracles in a strong security model allowing adversary to compromise critical information of session participants such as long-term or ephemeral private key.

DOI
10.6633/ijns.201603.18(2).12

Related papers

Beyond eCK: Perfect Forward Secrecy Under Actor Compromise and Ephemeral-key Reveal

Cas J. F. Cremers, Michèle Feltz

Abstract. We show that it is possible to achieve perfect forward secrecy in two-message or one-round key exchange (KE) protocols even in the presence of very strong active adversaries that can reveal random values of sessions and compromise long-term secret keys of parties. We provide two new game-based security models for KE protocols with increasing security guarantees, namely, eCKw and eCK-PFS. The eCKw model is a slightly stronger variant of the extended Canetti-Krawczyk (eCK) security model. The eCK-PFS model captures perfect forward secrecy in the presence of eCKw adversaries. We propose a security-strengthening transformation (i. e., a compiler) from eCKw to eCK-PFS that can be applied to protocols that only achieve security in a weaker model than eCKw, which we call eCKpassive. We show that, given a two-message Diffie-Hellman type protocol secure in eCKpassive, our transformation yields a two-message protocol that is secure in eCK-PFS. We demonstrate how our transformation can be applied to concrete KE protocols. In particular, our methodology allows us to prove the security of the first known one-round protocol that achieves perfect forward secrecy under actor compromise and ephemeral-key reveal. 1

•Jan 1, 2015•0 citations

Strongly Secure One-round Group Authenticated Key Exchange in the Standard Model.

Yong Li, Zheng Yang

One-round group authenticated key exchange (GAKE) protocols typically provide implicit authentication and appealing bandwidth efficiency. As a special case of GAKE – the pairing-based one-round tripartite authenticated key exchange (3AKE), recently gains much attention of research community due to its strong security. Several pairing-based one-round 3AKE protocols have recently been proposed to achieve provable security in the g-eCK model. In contrast to earlier GAKE models, the g-eCK model particularly formulates the security properties regarding resilience to the leakage of various combinations of long-term key and ephemeral session state, and provision of weak perfect forward secrecy in a single model. However, the g-eCK security proofs of previous protocols are only given under the random oracle model. In this work, we give a new construction for pairing-based one-round 3AKE protocol which is provably secure in the g-eCK model without random oracles. Security of proposed protocol is reduced to the hardness of Cube Bilinear Decisional Diffie-Hellman (CBDDH) problem for symmetric pairing. We also extend the proposed 3AKE scheme to a GAKE scheme with more than three group members, based on multilinear maps. We prove g-eCK security of our GAKE scheme in the standard model under the natural multilinear generalization of the CBDDH assumption.

•Jan 1, 2013•0 citations

Modeling Leakage of Ephemeral Secrets in Tripartite/Group Key Exchange

Mark Manulis, Koutarou Suzuki, Berkant Ustaoğlu

We propose a security model, referred as g-eCK model, for group key exchange that captures essentially all non-trivial leakage of static and ephemeral secret keys of participants, i.e., group key exchange version of extended Canetti-Krawczyk (eCK) model. Moreover, we propose the first one-round tripartite key exchange (3KE) protocol secure in the g-eCK model under the gap Bilinear Diffie-Hellman (gap BDH) assumption and in the random oracle model.

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Dec 31, 2012•6 citations

eCK Secure Single Round ID-based Authenticated Key Exchange Protocols with Master Perfect Forward Secrecy (Extended Version)

Tapas Pandit, Rana Barua, Somanath Tripathy

Recently, LaMacchia, Lauter and Mityagin proposed the extended Canetti-Krawczyk (eCK) model for Authenticated Key Exchange (AKE) protocols that covers many attacks on existing models. An ID-based AKE protocol with Perfect Forward Secrecy (PFS) (respectively Master Perfect Forward Secrecy (MPFS)) ensures that revelation of the static keys of the parties (respectively the master secret key of the private key generator), must not compromise even a single bit of the session keys of the past sessions between the parties. Currently, to the best of our knowledge, there is no ID-based eCK secure single round AKE protocol with either PFS or MPFS. In our preliminary version [18] we have proposed, without proofs, ID-based eCK secure single round AKE protocols with PFS and MPFS in the random oracle model. To achieve this, we also have constructed ID-based eCK secure single round AKE protocols, one without Master Forward Secrecy (MFS) and one with MFS, almost at the same computational cost as the existing efficient ID-based eCK Secure Single Round AKE protocols. In this full version, we provide proofs to show that all of our protocols are secure under the Gap Bilinear Diffie-Hellman (GBDH) problem.

Journal of Wireless Mobile Networks Ubiquitous Computing and Dependable Applications•Jan 1, 2014•1 citation

Strongly Secure One Round Authenticated Key Exchange Protocol with Perfect Forward Security.

Hai Huang

Abstract. This paper investigates the two-pass authenticated key exchange protocol in the enhanced Canetti-Krawczyk (eCK) with perfect forward security. Currently, there exist no authenticated key exchange protocols which are provably secure in eCK model and meanwhile achieve perfect forward security against active adversary in one round. We propose a new two-pass authenticated key exchange protocol which enjoys following desirable properties. First, our protocol is shown secure in the eCK model under the gap Diffie-Hellman (GDH) assumption. Moreover, our protocol does not use the NAXOS transformation, the drawback of which will be discussed in the introduction. Second, under the same assumption, we prove that our protocol achieves perfect forward security against active adversary in one round. To the best of our knowledge, our proposal is first two-pass (one round) AKE protocol provably secure in the eCK model and achieving perfect forward security against active adversary.

•Jan 1, 2011•0 citations

A practical strongly secure one‐round authenticated key exchange protocol without random oracles

Zheng Yang, Yang Wu

Abstract Most recently, a variant of extended Canetti–Krawczyk model called aseCKwis introduced to provide stronger security than previous eCK models. NamelyeCKwmodels formulate a stronger notion regarding weak perfect forward secrecy than other eCK models. In particular, anyeCKwsecure protocols can be generally transformed to achieve full provide perfect forward secrecy without requiring additional round. So far, there is no protocol which has been proven secure in theeCKwmodel without random oracles. In this paper, we study the open problem on constructingeCKwsecure AKE protocol in the standard model. A new one‐round AKE protocol is introduced relying on standard cryptographic primitives and a variant of bilinear decisional Diffie–Hellman assumption. The main advantage of our proposal is its high efficiency in key exchange in contrast to the previous eCK secure protocols without random oracles and under post‐specified peer setting. Copyright © 2014 John Wiley & Sons, Ltd.

Security and Communication Networks•Sep 9, 2014•3 citations
We propose two security models for one-round group key exchange (ORGKE), which are called as g-eCKw and g-eCK-PFS. The g-eCK-PFS is a stronger variant of g- eCKw, which particularly formulates perfect forward se- crecy for ORGKE. A new tripartite ORGKE is proposed to provide g-eCKw security without random oracles under standard assumptions, that is also more e_cient than its predecessor by Li and Yang on CANS'13. We also show how to transform (compile) a g-eCKw secure protocol to achieve g-eCK-PFS security. In particular, our result enables us to prove the security of the first ORGKE protocol that achieves perfect forward secrecy without random oracles in a strong security model allowing adversary to compromise critical information of session participants such as long-term or ephemeral private key.
Abstract. We show that it is possible to achieve perfect forward secrecy in two-message or one-round key exchange (KE) protocols even in the presence of very strong active adversaries that can reveal random values of sessions and compromise long-term secret keys of parties. We provide two new game-based security models for KE protocols with increasing security guarantees, namely, eCKw and eCK-PFS. The eCKw model is a slightly stronger variant of the extended Canetti-Krawczyk (eCK) security model. The eCK-PFS model captures perfect forward secrecy in the presence of eCKw adversaries. We propose a security-strengthening transformation (i. e., a compiler) from eCKw to eCK-PFS that can be applied to protocols that only achieve security in a weaker model than eCKw, which we call eCKpassive. We show that, given a two-message Diffie-Hellman type protocol secure in eCKpassive, our transformation yields a two-message protocol that is secure in eCK-PFS. We demonstrate how our transformation can be applied to concrete KE protocols. In particular, our methodology allows us to prove the security of the first known one-round protocol that achieves perfect forward secrecy under actor compromise and ephemeral-key reveal. 1
One-round group authenticated key exchange (GAKE) protocols typically provide implicit authentication and appealing bandwidth efficiency. As a special case of GAKE – the pairing-based one-round tripartite authenticated key exchange (3AKE), recently gains much attention of research community due to its strong security. Several pairing-based one-round 3AKE protocols have recently been proposed to achieve provable security in the g-eCK model. In contrast to earlier GAKE models, the g-eCK model particularly formulates the security properties regarding resilience to the leakage of various combinations of long-term key and ephemeral session state, and provision of weak perfect forward secrecy in a single model. However, the g-eCK security proofs of previous protocols are only given under the random oracle model. In this work, we give a new construction for pairing-based one-round 3AKE protocol which is provably secure in the g-eCK model without random oracles. Security of proposed protocol is reduced to the hardness of Cube Bilinear Decisional Diffie-Hellman (CBDDH) problem for symmetric pairing. We also extend the proposed 3AKE scheme to a GAKE scheme with more than three group members, based on multilinear maps. We prove g-eCK security of our GAKE scheme in the standard model under the natural multilinear generalization of the CBDDH assumption.
Recently, LaMacchia, Lauter and Mityagin proposed the extended Canetti-Krawczyk (eCK) model for Authenticated Key Exchange (AKE) protocols that covers many attacks on existing models. An ID-based AKE protocol with Perfect Forward Secrecy (PFS) (respectively Master Perfect Forward Secrecy (MPFS)) ensures that revelation of the static keys of the parties (respectively the master secret key of the private key generator), must not compromise even a single bit of the session keys of the past sessions between the parties. Currently, to the best of our knowledge, there is no ID-based eCK secure single round AKE protocol with either PFS or MPFS. In our preliminary version [18] we have proposed, without proofs, ID-based eCK secure single round AKE protocols with PFS and MPFS in the random oracle model. To achieve this, we also have constructed ID-based eCK secure single round AKE protocols, one without Master Forward Secrecy (MFS) and one with MFS, almost at the same computational cost as the existing efficient ID-based eCK Secure Single Round AKE protocols. In this full version, we provide proofs to show that all of our protocols are secure under the Gap Bilinear Diffie-Hellman (GBDH) problem.
Abstract. This paper investigates the two-pass authenticated key exchange protocol in the enhanced Canetti-Krawczyk (eCK) with perfect forward security. Currently, there exist no authenticated key exchange protocols which are provably secure in eCK model and meanwhile achieve perfect forward security against active adversary in one round. We propose a new two-pass authenticated key exchange protocol which enjoys following desirable properties. First, our protocol is shown secure in the eCK model under the gap Diffie-Hellman (GDH) assumption. Moreover, our protocol does not use the NAXOS transformation, the drawback of which will be discussed in the introduction. Second, under the same assumption, we prove that our protocol achieves perfect forward security against active adversary in one round. To the best of our knowledge, our proposal is first two-pass (one round) AKE protocol provably secure in the eCK model and achieving perfect forward security against active adversary.
Abstract Most recently, a variant of extended Canetti–Krawczyk model called aseCKwis introduced to provide stronger security than previous eCK models. NamelyeCKwmodels formulate a stronger notion regarding weak perfect forward secrecy than other eCK models. In particular, anyeCKwsecure protocols can be generally transformed to achieve full provide perfect forward secrecy without requiring additional round. So far, there is no protocol which has been proven secure in theeCKwmodel without random oracles. In this paper, we study the open problem on constructingeCKwsecure AKE protocol in the standard model. A new one‐round AKE protocol is introduced relying on standard cryptographic primitives and a variant of bilinear decisional Diffie–Hellman assumption. The main advantage of our proposal is its high efficiency in key exchange in contrast to the previous eCK secure protocols without random oracles and under post‐specified peer setting. Copyright © 2014 John Wiley & Sons, Ltd.